mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

swarm-stt: the deploy module (deploy.stt.*, sandboxed container, store leaf, queue grants) and its docs

Browse source
This commit is contained in:
damocles 2026-11-12 08:36:32 +01:00 • committed by mara
commit 96b5b83fa4
1 changed files with 594 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

34
nix/module-eval/swarm-services-switch.nix
View file

@ -177,7 +177,7 @@ let
# Every service container at once: the services-only host plus the CI
# runner. The CI runner, the review classifier, the notification router, the
# builder, the claude login minter, the metrics store, the homeserver,
# authelia, Grafana, the collector and the cache are the eleven containers on
# authelia, Grafana, the collector and the cache are the twelve containers on
# a netns of their own.
serviceContainersWithCi = hive {
deploy.hive-controller.enable = false;
@ -204,6 +204,7 @@ let
"swarm-notify-router"
"swarm-otel"
"swarm-review-classifier"
"swarm-stt"
"swarm-victorialogs"
"swarm-victoriametrics"
];
@ -429,6 +430,25 @@ let
&& !(sc.DynamicUser or false)
&& swarmServicesHere.services.hyperhive.deploy.nats.enable;
}
{
name = "hosting the swarm's shared services runs the speech-to-text service as an unprivileged user under a sandbox";
ok =
let
c = swarmServicesHere.containers.swarm-stt.config;
sc = c.systemd.services.swarm-stt.serviceConfig;
in
swarmServicesHere.services.hyperhive.deploy.stt.enable
&& c.users.users.swarm-stt.isSystemUser
&& sc.User == "swarm-stt"
&& !(sc.DynamicUser or false)
&& sc.NoNewPrivileges
&& sc.ProtectSystem == "strict"
&& sc.PrivateTmp
&& sc.CapabilityBoundingSet == ""
&& sc.MemoryMax == "3G"
&& sc.StateDirectory == "swarm-stt"
&& c.systemd.services.swarm-stt.environment.SWARM_STT_MAX_WAITING == "3";
}
{
# dhcpcd without IPv4LL, waiting for IPv4: `network-online` is a lease.
# The router sets no `nohook` itself and authelia does; `nohook` is the
@ -454,6 +474,12 @@ let
&& lib.elem "network-online.target" fetch.after
&& lib.elem "network-online.target" fetch.wants;
}
{
name = "the speech-to-text service stays off where the shared services are hosted without the store";
ok =
!swarmServicesBaoElsewhere.services.hyperhive.deploy.stt.enable
&& !(swarmServicesBaoElsewhere.containers ? swarm-stt);
}
{
name = "the notification router stays off where the shared services are hosted without the store";
ok =
@ -810,15 +836,15 @@ let
# that lost a container can't pass by comparing fewer of them.
name = "every service container restates its host-side privateNetwork";
ok =
lib.length (lib.attrNames serviceContainers) == 15
lib.length (lib.attrNames serviceContainers) == 16
&& lib.all (
c: c.privateNetwork == (c.config.services.hyperhive.swarmContainer.privateNetwork or null)
) (lib.attrValues serviceContainers);
}
{
# Both values come from ../container-modules/swarm-container.nix.
# Four of the 15 service containers share the host netns (hive-forge, bao,
# the queue, the log store) and eleven have one of their own.
# Four of the 16 service containers share the host netns (hive-forge, bao,
# the queue, the log store) and twelve have one of their own.
name = "a service container on the host netns runs no firewall or resolvconf of its own";
ok =
let